apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: oneimage
  namespace: app-created-namespace
  labels:
    acorn.io/app-name: app-name
    acorn.io/app-namespace: app-namespace
    acorn.io/managed: "true"
    acorn.io/container-name: oneimage
rules:
- apiGroups:
  - bar.io
  resources:
  - foo
  verbs:
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: oneimage-app-name-app-namespace-1234567890ab-ns1
  namespace: ns1
  labels:
    acorn.io/app-name: app-name
    acorn.io/app-namespace: app-namespace
    acorn.io/managed: "true"
    acorn.io/container-name: oneimage
rules:
  - verbs:
      - create
    apiGroups:
      - "2.foo.io"
    resources:
      - "2.bar"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: oneimage-app-name-app-namespace-1234567890ab-ns2
  namespace: ns2
  labels:
    acorn.io/app-name: app-name
    acorn.io/app-namespace: app-namespace
    acorn.io/managed: "true"
    acorn.io/container-name: oneimage
rules:
  - verbs:
      - create
    apiGroups:
      - "2.foo.io"
    resources:
      - "2.bar"
